API keys
One key does everything. Create it in your dashboard while logged in, then send it as X-API-Key on any API call — sending, domains, mailboxes, attachments, tracking, billing and the rest. The same key works everywhere, so your services only store one secret.
The secret is shown once when you create or regenerate it. Copy it into your
secrets manager immediately — it cannot be shown again.
Rotate and revoke
Regenerate or revoke a key anytime from the same dashboard screen. Regenerating
replaces the secret; revoking stops it at once. Update your services with the
new secret after a rotation.
Sessions are separate
Logging in (email and password, code, magic link or OAuth) returns short-lived
access and refresh tokens for dashboard use. Services and scripts use the API
key; browsers use the login session. Read Authentication
for the sign-in flows.